darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
40 lines
1.4 KiB
Nix
40 lines
1.4 KiB
Nix
{ config, pkgs, inputs, ... }:
|
|
|
|
# Authentik — self-hosted identity/OIDC provider. Replaced Zitadel because
|
|
# nixpkgs is stuck on 2.71 (no login-v2 split) with a forward-only db
|
|
# migration; authentik-nix tracks upstream closely instead.
|
|
#
|
|
# The upstream module owns postgres and its unit ordering, and needs no redis
|
|
# (channels/cache run on postgres). TLS terminates at Caddy; every listener
|
|
# below is pinned to loopback since only tailscale0 is trusted.
|
|
#
|
|
# Needs an environmentFile from sops (host's secrets.nix) carrying
|
|
# AUTHENTIK_SECRET_KEY and AUTHENTIK_BOOTSTRAP_PASSWORD. Keep it root:root
|
|
# 0400 (systemd reads it as root before dropping to DynamicUser) — don't set
|
|
# `owner` the way headplane's secrets need.
|
|
{
|
|
imports = [ inputs.authentik-nix.nixosModules.default ];
|
|
|
|
# Pinned explicitly: the default tracks system.stateVersion, so editing that
|
|
# would silently demand a pg_upgrade of the identity store.
|
|
services.postgresql.package = pkgs.postgresql_17;
|
|
|
|
services.authentik = {
|
|
enable = true;
|
|
environmentFile = config.sops.templates."authentik.env".path;
|
|
|
|
settings = {
|
|
# Default is 0.0.0.0 on all three; behind Caddy loopback is enough.
|
|
listen = {
|
|
listen_http = "127.0.0.1:9000";
|
|
listen_https = "127.0.0.1:9443";
|
|
listen_metrics = "127.0.0.1:9300";
|
|
};
|
|
|
|
disable_startup_analytics = true;
|
|
error_reporting.enabled = false;
|
|
avatars = "initials";
|
|
};
|
|
};
|
|
}
|